Client Server Hardware Key Login
Normally I do this the other way around, releasing the new build and then reviewing the features. This time, I'll review some of the key new features this week and then
with any luck, I'll be finished the final touchup on Build 13C1.00 before week's end August 7th.
I've had the opportunity this summer to work on a project that required the software to be locked to the hardware on which it is installed. Since this is also client-server software, requiring a login and download of stock market and money market data for display, I was able to use a standard CHT Client Server with some strategic changes to achieve a login-style data connection to an MSSQL server as well as a software-locked-to-hardware condition. These strategic changes are now reflected in Build 13C1.00 templates.
This is not to say that hardware key login could not be achieved without these latest template changes. Obviously, before a template can be written that generates code, somebody has to write the code that's going to be generated first. After writing and testing and re-writing the concept, I was able to abstract the requirements considerably in order to have the template help CHT developers achieve a
Hardware Key Login.
Normally a CHT server login requires three pieces of information. I normally use Last Name, Email Address and a Login ID. There's nothing that says you actually need to use those specific bits of information, at least not the Last Name and Email Address, these fields and keys can be juggled on the template interace to use something else which is appropriate. The Login ID, on the other hand is more rigid concept and harder to work around since it is assumed to be numeric and unique.
For this login the customer wanted to use a USERNAME and PASSWORD only for the user to fill in at login time. But he wanted the software to
"lock itself to the hardware on which it was installed". That means, once installed, and run on a given computer, it will not connect to the back end using any other computer even though it' s copied or installed there, and the USERNAME and PASSWORD are known. This prevents users in an office setting from buying one license of the software and sharing it amongst themselves in the office.
The concept is flexible enough that if the user wants some time later to move the software to another machine, he can contact the vendor and the hardware key can be purged from the customer's data record, allowing the software to be installed successfully and locked to a different machine.
In the background the application creates a HARDWARE KEY, a unique piece of data consisting of something which is unique to the machine on which it is running. You can use a combination of things such as the hard disk serial number or the primary MAC address or you can simply have the installer generate a GUID which is written into the registry and encrypted. This HARDWARE KEY is used as the third piece of login data along with USERNAME and PASSWORD instead of a LOGINID.
The first time the user logs in, the login is achieved by USERNAME and PASSWORD only because the hardware key field in the data base is blank. During the first login, that hardware key - which is passed up with each login - is written into the data base and left there. After that, subsequent logins are achieved via the hardware
key in combination with the USER NAME and PASSWORD. The same user running the software on a different piece of hardware is not allowed to log in since the hardware key generated on that machine is different than the one now stored in the data base against his other credentials.
Hardware Key-Style Login Specifics
Once you decide that a hardware key-style login is what you want, a lot of the work is done for you by the templates. Your back-end tables require aslightly different combination of fields than normal, but not all that much. You need a string(100) hardware key field in place of the usual numeric login ID field. Our back-end table also contains UserName and Password fields. This is not strictly necessary, as you could use any two other fields, for example, last name and email address as long as these two fields, used in combination, provide a unique key value that results in the ability to make an unambiguous fetch on the data base.
Since our example is an SQL implementation, our data table does not actually have any keys other than the standard SYSID. Our clarion dictionary, of course, declares a unqique key on the hardware key field and on the combination UserName+Password fields, but these key declarations are only there for the Clarion file drivers will generate the correct SQL SELECT. These keys are not actually required to be in the data base table declarion.
Initially, let's take a look at a new button on the "File" dialog of the BrowserServerInitializationControls template, called "Implement Hardware Key-Style Login" (see image below).
Notice here that the first two fields of the file dialog are completed as usual with the user or customer table name and sysID key. The third field receives the HARDWARKEY unique key and the fourth field receives the unique compound key consisting of USERNAME and PASSWORD. Again this compound key could be any two values, for example Last Name and Email Address, which in combination can be used to obtain a unique value for login. In our implementation the USERNAME and PASSWORD are completed on the client application's login interface by the user. The hardware key is code-dervided by the client application.
The
"Implement Hardware Key-Style Login" dialog explains these concepts again and requires only that you check the switch provided (see image below).
If your key field design matches these requirements your hardware key-style login implmentation is complete, on the server side at least. Checking the switch (above) to the ON setting causes our template to not generate the standard LastName, Email Address LoginID login and instead the code pictured below is generated into the Server.TakeLoginDetailsRequest() procedure (See image below).
I've heavily commented the generated code above so the implementation should be clear enough. The first time a user logs in with a USERNAME and PASSWORD,
the hardware key is not yet stored. The user is warned that he must initially install to the machine on which the software will be used. Initially the generated code attempts to retrieve the user account using the hardware key. This will fail under two conditions, either the user has never logged in before,and his hardware key is not yet stored, or the user is logging in with the correct user name and password from the wrong hardware. If the hardware key exists in the file, the user name and password provided are qualified against the account on file, and if these match, the login is permitted. If the hardware key is not found, the user's account is fetched using the unique combination USERNAME and PASSWORD and the hardware key provided is stored to that account and the login is permitted.
Hardware Key-Style Login (Client-Side)
On the client side, to accommodate hardware key-style login, we've provided a new method called "ThinClientHardwareKeyLogin()" (see image below).
Inside our client application all the necessary information to perform the hardware key-style login is collected and passed in the ThinClientHardwareKeyLogin() method - before the PARENT call. This makes it easy to debug any login problems on the client application side.
The following properties are completed here, only one of which is unique to this hardware key login. The properties initialized are as follows:
The first two properties - Encryption and Compression - are determined strictly by the client. The server does not have to be told about them in advance. Since the client communicates the encryption/compression states to the server during the transaction and the server responds in kind based on the state information provided in each communication. Encryption is not static, nor is it predictable, every single communication between client and server is uniquely encrypted.
SELF.SetUseEncryption(True) !We've turned encryption on.
SELF.SetUseCompression(True) !We've turned compression on.
SELF.RemoteUrl = CHTDataServerURL !This can be hard coded in the app or determined by app configuration.
SELF.RemotePort = CHTDataServerPort !This can be hard coded in the app or determined by app configuration.
SELF.LoginID = 0 !This property is not required to be set in a hardware key style login.
SELF.HardwareKey = MOD:HardwareKey !This new property (STRING 100) is provided with any static hardware-unique key you decide to derive in code.
SELF.LastName = UserName !This property value comes from a UserName field completed at login.
SELF.EmailAddress = Password !This property value comes from a Password field completed at login.
Note that there are no separate HNDCLIENT properties for USERNAME and PASSWORD. We're placing this information into the SELF.LastName and SELF.EmailAddress properties.
If you check in the server code, you'll see that the server is picking up the "lastname=xxx" tag from the client and passing it to the server's UserName data
field while the "emailaddress=xxx" tag is passed to the server's Password data field. In fact any two pieces of information that in combination provide a unique value can be used as the login, using these SELF.Lastname and SELF.EmailAddress properties. The server and client just need to understand ahead of time what combination of fields will be used.
That completes Hardware Key-Style Login. In the next posting, Build 13C1.00 Feature Review Part 3, I'll cover several new CHT Client Server features having to do with SQL implementations.
Cheers...
Gus Creces
The Clarion Handy Tools Page
www.cwhandy.com support@cwhandy.com August 3, 2009